EP2081354B1 - Procédé et dispositifs de gestion des privilèges d'accès - Google Patents

Procédé et dispositifs de gestion des privilèges d'accès Download PDF

Info

Publication number
EP2081354B1
EP2081354B1 EP08150277A EP08150277A EP2081354B1 EP 2081354 B1 EP2081354 B1 EP 2081354B1 EP 08150277 A EP08150277 A EP 08150277A EP 08150277 A EP08150277 A EP 08150277A EP 2081354 B1 EP2081354 B1 EP 2081354B1
Authority
EP
European Patent Office
Prior art keywords
access
identities
privileges
accumulated
networked devices
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP08150277A
Other languages
German (de)
English (en)
Other versions
EP2081354A1 (fr
Inventor
Martin Rasmusson
John Rehn
Mattias Kindborg
Sebastian Hultqvist
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Axis AB
Original Assignee
Axis AB
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Axis AB filed Critical Axis AB
Priority to AT08150277T priority Critical patent/ATE521182T1/de
Priority to ES08150277T priority patent/ES2370558T3/es
Priority to EP08150277A priority patent/EP2081354B1/fr
Priority to TW097151492A priority patent/TWI461924B/zh
Priority to CN200910000290.9A priority patent/CN101488955B/zh
Priority to US12/353,036 priority patent/US8713643B2/en
Priority to KR1020090002865A priority patent/KR101235408B1/ko
Priority to JP2009005281A priority patent/JP4929294B2/ja
Publication of EP2081354A1 publication Critical patent/EP2081354A1/fr
Application granted granted Critical
Publication of EP2081354B1 publication Critical patent/EP2081354B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices

Definitions

  • a method and devices for configuring access privileges to networked devices in a network system are described.
  • the system may be arranged to provide users with specific access privileges. These access privileges may for instance be that the user is allowed to access the video from a surveillance camera A, but not access a pan tilt control for controlling the viewing direction of the same camera.
  • access privileges schemes are often implemented in security systems, e.g. surveillance systems, burglary protections, access control systems, fire alarm systems, etc.
  • security systems e.g. surveillance systems, burglary protections, access control systems, fire alarm systems, etc.
  • a scheme for access privileges becomes very important.
  • US 2005/0097353 describe a method for searching a subset of policies within a set of policies.
  • Each policy can be used to control access to a resource.
  • the set of policies includes the following policy components, a resource a subject, and one of an action and a role name, and wherein the subject includes at least one of, a user and a group.
  • the search is performed by specifying one or more search criteria including one or more values for policy components.
  • the values for policy components may even include one or more wild cards.
  • US 6 208 379 Oya et al. , some methods for managing access privileges are described.
  • One method described in US 6 208 379 for facilitating the managing of access privileges is to bundle users into user groups as described above.
  • US 6 208 379 describes setting access privileges for a user group by selecting a camera from a camera list, indicating in a dialog box which is opened upon selection of the camera that access privilege settings is requested. Then an access control panel or dialog box of the camera is presented. In the access control panel it is possible to select a predefined access mode. By changing the access mode of the camera predefined access privileges for all the user groups are set in the system. In order to set the access privileges at a more detailed level an access privilege window is opened from the access control panel. The access privilege window then present a matrix indicating the access privileges of each user group relating to each function of the selected camera.
  • One object of the invention is to facilitate setting of access privileges for a plurality of network devices and facilitate the customisation of the access privileges.
  • a method for configuring access privileges in a system of networked devices comprises selecting a plurality access identities, retrieving information of access privileges of each of the selected access identities to accessible functions of networked devices, accumulating the access privileges of the selected access identities for each one of said accessible function of each one of said networked devices, presenting said accumulated access privileges for each one of said accessible function of each one of said networked devices in an interface allowing editing of the accumulated access privileges, indicating a change in accumulated access privileges to a specific function in a specific networked device, and configuring the specific function of the specific networked device for allowing access by the selected users in accordance with the indicated change of accumulated access privileges.
  • changing access privileges are facilitated, in particular in regard of changing access privileges in cases where the access privileges of users are not already related to each other in the system and where access privileges regarding a plurality of devices are to be changed.
  • said accumulating the access privileges includes counting the number of selected access identities having access privileges to each one of said functions of each one of said networked devices.
  • the previous mentioned accumulating step may be extended by setting the accumulated access privilege for a specific function of a networked device to a value indicating that all selected access identities are allowed access to the specific function if said counting indicates that all selected users are allowed access to the specific function, setting the accumulated access privilege for a specific function of a networked device to a value indicating that none of the selected access identities are allowed access to the specific function if said counting indicates that none of the selected access identities are allowed access to the specific function, and setting the accumulated access privilege for a specific function of a networked device to a value indicating that some of the selected access identities are allowed access to the function if said counting indicates that some of the selected access identities are allowed access to the function.
  • the method further comprises sending via a computer network information representing said accessible functions of said networked devices, information representing the accumulated access privilege associated with each one of these functions, and information enabling identification of the selected access identities, to a client computer performing said presenting.
  • said information enabling identification of the selected access identities is a list including identifiers of the selected access identities.
  • said information enabling identification of the selected access identities is an identifier identifying the location of a list including identifiers of the selected access identities.
  • the method further comprising returning via the computer network information representing each one of said accessible functions of each one of said networked devices, accumulated access privilege associated with each of these functions, and information enabling identification of the selected access identities, wherein the accumulated access privilege associated with at least one function of a networked device has been changed in relation to the corresponding information previously sent via the computer network.
  • the at least one function of a networked device for which the accumulated access privilege has been changed is tagged in order to indicate that the accumulated access privilege to this particular function has been changed in relation to the corresponding information previously sent via the computer network.
  • said act of indicating a change in accumulated access privileges to a specific function in a specific network device only enables changing an access privilege of a specific function of a specific network device to either allowing all users identified by the selected access identities to access the specific function or allowing none of the selected users to access the specific function.
  • the selecting of a plurality of access identities include selecting a plurality of access identities from access identities registered for using the system.
  • the selecting of access identities includes selecting individual users.
  • the selecting of access identities includes selecting user groups.
  • a server for handling access privileges in a system of networked devices comprises an access privileges manager arranged to retrieve information of access privileges of individually selected access identities to accessible functions associated with networked devices, and arranged to generate a message including accumulated access privileges in view of the selected access identities for said functions of the networked devices, an access privileges accumulator arranged to accumulate the access privileges of the selected access identities for said accessible functions of the networked devices from said retrieved information, and an access privileges configurator arranged to configure the access privileges of accessible functions of networked devices for the selected access identities in accordance with a received message including an indicator indicating that the access privileges of said function of the networked device is to be changed.
  • a server having this configuration makes it possible to facilitate operations of changing access privileges for individual users and a plurality of network devices. This may be particularly true for operations where the access privileges of non related users to a plurality of devices are to be changed. By accumulating the access privileges as described above such an operation of changing access privileges is enabled.
  • said access privileges accumulator is arranged to accumulate the access privileges by counting the number of selected access identities having access privileges to each one of said accessible functions of the networked devices.
  • the advantage of this is that it is a non complicated way of achieving an accumulator value, or in other terms to achieve a value representing the access privileges of a plurality of individual users who do not have to have identical access privileges.
  • the access privileges accumulator further is arranged to set the accumulated access privilege for a specific function of a networked device to a value indicating that all selected access identities are allowed access to the specific function if said counting indicates that all selected users are allowed access to the specific function, set the accumulated access privilege for a specific function of a networked device to a value indicating that none of the selected access identities are allowed access to the specific function if said counting indicates that none of the selected access identities are allowed access to the specific function, and set the accumulated access privilege for a specific function of a networked device to a value indicating that some of the selected access identities are allowed access to the function if said counting indicates that some of the selected access identities are allowed access to the function.
  • This access privileges accumulator facilitates the management of the access privileges of the selected users as the person managing the access privileges by changing access privileges may be given a quick overview of the present status by means of these three states.
  • the access privileges manager is arranged to include, in said generated message, information representing accessible functions of the networked devices, the accumulated access privilege associated with each included function, and information enabling identification of the selected access identities.
  • the system is a monitoring system.
  • the access identities include a user identity and in a further embodiment the access identities include a user group identity.
  • a client for changing access privileges to functions of networked devices of a system comprises a display, an input means, means for selecting access identities, said means being arranged to present access identities on the display and to allow a user of the client to select access identities by means of the input means, and means for changing access privileges for selected access identities to accessible functions of networked devices, said means being arranged to present accumulated access privileges relating to said accessible functions of the networked devices on the display, to allow a user of the client to select and change the accumulated access privileges for presented functions, and to generate a message including information of changed accumulated access privileges.
  • This client may present the advantage of facilitating change of access privileges to a plurality of networked devices and for customising access privileges for the users.
  • the means for changing access privileges is arranged to receive a message via a network interface, said message includes information representing accessible functions of networked devices, information representing the accumulated access privileges associated with each of these functions, and information enabling identification of the selected access identities.
  • said generated message includes information representing accessible functions of networked devices, information representing the accumulated access privileges associated with each of these functions, an indicator indicating each accumulated access privileges that has been changed, and information enabling identification of the selected access identities.
  • the information enabling identification of the selected access identities is a list including identifiers of the selected access identities.
  • the information enabling identification of the selected access identities is an identifier identifying the location of a list including identifiers of the selected users.
  • networked device should be understood as a device including circuitry for enabling sending and receiving signals and/or messages over a computer network and wherein the device is arranged to send data or information resulting from the functionality of the device over the computer network.
  • a system according to one embodiment of the invention is schematically depicted in Fig 1 .
  • the system includes an access server 10 arranged to control and manage access privileges of the networked devices 12, 14, and 16. Further the system includes a client 18, which may be used to access information in the access server 10 relating to access privileges of the system, and a network connecting the server 10, the networked devices 12, 14, and 16, and the client 18.
  • the access server 10 is a server that controls the access privileges of registered users to networked devices in the system.
  • the networked devices 12, 14, and 16 may be any device connected to a network and arranged to be controlled or provide data via the network.
  • the client 18 may be a computer enabling an administrator logging in to the server 10 and accessing information associated with the access privileges of registered access identities to functions of the networked devices 12, 14, and 16.
  • access identities may be user identities and/or user group identities.
  • the networked devices 12, 14, and 16 may, as stated above, be any device providing data over the network and/or being controllable via the network.
  • a networked device may be a video camera 12 enabled to communicate via the network for delivering video to a video server and/or for receiving control signals, e.g. controlling any one of or any combination of pan, tilt, aperture, frame rate, image resolution, etc.
  • Such a networked camera 12 may typically be operated for monitoring or surveillance purposes.
  • Another example of a networked device is an entry control system 14 used for controlling access to closed facilities or areas. However, many other devices may be contemplated by the skilled person.
  • the access server 10 includes all components and functions of an ordinary server that is arranged to handle, send and receive data via a computer network.
  • the access server 10 includes a CPU 52, Central Processing Unit, for processing of functions of an ordinary server as well as functions relating to the invention.
  • the access server includes a volatile memory 54 for temporary storage of data, information, instructions, etc, relating to the functions of an ordinary server as well as functions relating to the invention.
  • the volatile memory 54 may for example be a RAM, Random Access Memory.
  • the access server includes a network interface 56 for enabling communication with other devices connected to the network, e.g. the networked devices. How to implement a network interface is known to the skilled person.
  • the access server 10 also includes a non volatile memory 58, which may be a hard drive, a solid state drive, or any data storage device capable of storing data even when the power to the device is interrupted.
  • the non volatile memory is arranged to store information of the access privileges of registered users to functions of the networked devices in the system.
  • the storage capacity has to be adapted accordingly.
  • the access server may include a data base interface 60 for managing the input and output of data to and from a data base.
  • the data base may be arranged in the non volatile memory 58, but may also be arranged at another storage point connected to the network.
  • the access server 10 may include means for managing selection of access identities 62, means for managing access privileges 64 and means for configuring the access privileges 66.
  • the means for managing selection of access identities 62 is arranged to retrieve and send a list of access identities to a client computer for selection of access identities.
  • the list of access identities may be retrieved from the data base including the access privileges associated with registered access identities, e.g. registered users and/or registered user groups, or it may be retrieved from a user management server associated to the network, i.e. a server that manages data required for authenticating logins to the network.
  • a server may for instance, if the network system is a Microsoft based network, include the Active Directory.
  • the selection of access identities may be based on either one of those lists.
  • the list associated to authenticated login on the network is advantageously used when new access identities, i.e. not registered for accessing the networked devices, are to be given access to the networked devices that require access privileges.
  • the list of access identities registered for accessing the networked devices may advantageously be used in selecting access identities for which editing or changing the access privileges is to be performed.
  • the term access identities, in view of selecting access identities for changing access privileges may include user identities and/or user group identities. In the case of a user group being selected and registered an identity of the user group is stored.
  • the user group may be arranged to include user identifiers of the users associated with the user group, this enables retrieval of the users included in the user group when needed. This makes it possible to select user groups and single users for one management operation on the access privileges and then if the users of the user group changes the access privileges of the user group remains but the access privileges of a user leaving or being added to the user group changes.
  • the list 90 of access identities is stored in the data base of the access server or the data base associated to the access server according to one embodiment is showed.
  • the data base of the access server stores a list 92 of the networked devices and accessible functions of the devices and a list 94 in which an access privilege is associated to each function of each device and for each access identities.
  • the list 94 may be stored as a list or a matrix, however, in order to facilitate the description of the information contained in the list we will describe it as a matrix, hereinafter the list 94 will be referred to as the access privileges matrix 94.
  • the access privileges matrix 94 is a combination of the list of registered access identities 90, the list of networked devices 92, and the access privileges of these access identities in relation to the functions of the networked devices.
  • the means for managing selecting of access identities 62 is arranged to receive an indication of selected access identities from the client.
  • An access privileges matrix manager 68 is arranged to add the selected access identities if the selected access identities are access identities that are not registered in the access privileges matrix. Further, the access privileges matrix manager may be arranged to send the information from the access privileges matrix associated with the selected access identities to an access privileges accumulator 70.
  • the access privileges accumulator 70 is arranged to accumulate the access privileges of the selected access identities in an information structure that is to be sent to the client computer in order to enable changes of access privileges to be performed the client computer.
  • the access privileges accumulator 70 counts how many of the selected access identities that are registered as having access to each of the functions of each of the networked devices. If all of the selected access identities have access to a specific function of a networked device an entry relating to this particular function in this particular device is made stating that all selected access identities have access. If none of the selected access identities have access to a specific function of a networked device an entry relating to this particular function in this particular device is made stating that none of the selected access identities have access.
  • a third indicator is used in this system.
  • the accumulated list or matrix identifies by means of three states the accumulated access privileges of the selected access identities to each function of each network device.
  • An example of a part of an accumulated matrix is shown in Fig 4 .
  • Said three states may be referred to or indicated in the data transmission by an "all access"-indicator, a "none access”-indicator, and a "some access”-indicator.
  • the "all access"-indicator is indicated as a TRUE value
  • the "none access"-indicator is indicated as a FALSE value
  • the "some access”-indicator is indicated as a NULL indicator.
  • the means for managing access privileges 64 is arranged to generate a message including information that enables a change of access privileges from the client.
  • This information may be the accumulated access privileges and each associated function of each network device and a list of selected access identities, e.g. the accumulated matrix and a list of the selected access identities.
  • One example of the content of such a message is showed in Fig 5 .
  • the list of selected access identities may be represented in the message including the access privileges configuration information as a link or pointer to such a list stored in the server or any other network place. As a matter of fact the list of the selected access identities is not necessarily present or even used in the client.
  • the means for configuring the access privileges 66 is arranged to receive a configuration request from the client. Said received request includes adjusted accumulated access privileges for each associated function of each network device and the list of selected access identities. If the list of access identities is not sent to the client as described above the link or pointer sent from the access server to the client is returned.
  • the means for configuring the access privileges 66 is also arranged to instruct the access privileges matrix manager 68 to set the access privileges in the access privileges matrix in accordance with the access privileges configuration request.
  • the received request additionally includes an indicator for each function of each device and which indicator indicates whether the access privileges of the function of the device has changed for the selected access identities in relation to the access privileges of the accumulated list sent from the access server 10.
  • Dirty bits 98 may be used for indicators of changed access privileges as indicated in the example of a returned accumulated list showed in Fig 6 .
  • a dirty bit set to "1" indicates changed access privileges and a dirty bit set to "0" indicates no changes in access privileges.
  • the position for dirty bits may also be present in the accumulated list sent from the access server to the client.
  • the client includes a network interface 102, a CPU 104, a memory 106, an input means 108 and a display 110.
  • the network interface 102 is arranged to enable communication with other devices connected to the network, e.g. the access server. How to implement a network interface is known to the skilled person.
  • the CPU 104 is arranged to process the functions of the client and the memory is used for storage of information, e.g. temporary storage of executed instructions etc.
  • the client may be any general computer, such as a work station, a personal computer, a small handheld computer, a wireless telephone, a Personal Digital Assistant, etc, or it may be a specialised computer designed for being a client to the access server only.
  • the client includes means for selecting access identities 112 and means for changing access privileges 114.
  • the means for selecting access identities 112 are arranged for accessing the access server and requesting the access server to provide information of the access identities of the system or the users of the network. From this information the operator of the client may select said selected access identities and send back a list of selected access identities.
  • the means for selecting users 112 are arranged to display an interface in which the user of the client is able to chose between adding new access identities or changing access privileges for already registered access identities. Further it is arranged to send an indication of which one of the choices the user of the client selected to the access server. Further, the means for selecting access identities 112 is arranged to receive a list of access identities and present the content of the list on the display 110 via an interface enabling selection of access identities from the list. One example of such an interface is showed in Fig 8 . The users may be marked by means of indicating each line presenting a access identities of interest and when the users of interest is marked the select button is used to send the list of selected access identities to the access server.
  • the means for changing access privileges 114 is arranged to receive an information message including information that enables a change of access privileges by means of the client.
  • This information may be the accumulated access privileges and each associated function of each network device and a list of selected access identities, e.g. the accumulated list and a list of the selected access identities, as described in connection with the access server.
  • An example of an information message is shown in Fig 5 .
  • the means for changing access privileges further includes means for presenting the information of the information message in an interface enabling the user of the client to change the access privileges. An example of such an interface for changing access privileges is shown in Fig 9 .
  • the networked devices presented as cameras and I/O devices, are categorised and arranged under separate tabs 120, 122 of the interface.
  • Each device is presented on a separate line, the functions are presented in columns, and the accumulated access privileges for each function of each device is presented at the intersection of the networked device and the function.
  • An "x" indicates that all selected access identities have access
  • an empty box indicates that no selected access identities has access
  • an "o" indicates that some access identities but not all have access.
  • the interface is arranged to alternately change from "x" to empty and from empty to "x" in response to the user selecting the box.
  • the means for changing access privileges is arranged to change the accumulated list in accordance with the changes indicated in the interface and indicate every changed access privilege, i.e. every changed access privilege to a function of a networked device, with an indicator indicating a change in access privileges for all selected users in regard of the function of the networked device. This indication may be implemented as setting a dirty bit as discussed above in connection with the access server.
  • the means for changing access privileges 114 is also arranged to send the accumulated list as changed by the user of the client to the access server.
  • the system may be any authorization system enabling managing of access privileges.
  • the system may be a system implementing the discriminating implementation of only allowing users access devices which is registered as being allowed for the particular user to access.
  • the system may be an authorization module/system managing access to devices and/or functions of a security system, a surveillance system, a monitoring system etc., and in which systems different users are to have access to different devices and perhaps even different types of access to the devices to which they have access.
  • a user of a client computer may be restricted to this user having administrator privileges for the network and the system or to this user having administrator privileges for the system only, initiates the configuring of access privileges for functions of networked devices in the system by means of operating the client to send a request for a list of access identities, step 602.
  • the server provides access to a list of access identities registered for usage of the network and/or for usage of the system, step 604.
  • the list of access identities is then presented, e.g. by means of the interface described in connection with Fig 8 .
  • the user operating the client then operates the client and select access identities having access privileges that are to be managed, step 606.
  • the interface for managing the access privileges is arranged to process the selected access identities in identical ways.
  • the selected access identities are then used in the access server to prepare an accumulated access privileges matrix for the selected access identities only. If the selected access identities are access identities not registered in the system then the selected access identities have to be added to the registered access identities of the system, e.g. the access identities may be registered for the network, e.g. authenticated, but not the system, e.g. authorized for the system.
  • the access server retrieve the access privileges associated to the selected access identities, step 608, and then the number of access identities having access to each function of each of the devices are counted and accumulated, step 610.
  • This may be performed by making the server count the number of selected access identities that have access to each function of each network device and generating accumulated access privileges by comparing the number of selected access identities having access to each function of each networked device with the number of selected access identities.
  • the accumulated access privileges may represent either all selected access identities having access, none of the selected access identities having access, or some of the selected access identities having access.
  • the accumulated access privilege all selected access identities having access is represented by a "TRUE” value, none of the selected access identities having access is represented by a “FALSE” value, and some of the selected access identities having access is represented by a "NULL” value.
  • the server From the resulting accumulated access privileges the server generates a data structure, step 612, including a plurality of data entries, each representing a networked device, a function associated with the networked device, and the accumulated access privileges for this particular function of this particular device in relation to the selected access identities.
  • the data structure includes one of those data structures for each function of each networked device.
  • the generated data structure is then sent to the client together with the list of selected access identities.
  • the list of selected access identities sent to the client is replaced by a link or a pointer to the list and then the list may be stored at the server.
  • step 614 the information on the display connected to the client.
  • the information of the data structure of accumulated access privileges is presented in an interface for presentation and changing of access privileges, e.g. in an interface as the one described in connection with Fig 9 .
  • the operator of the client are then enabled to change the accumulated access privileges via the interface by simply selecting a specific access privilege which upon each selection alternates between all selected access identities getting access and none of the selected access identities getting access.
  • Each change of access privileges is stored in the data structure and may be indicated with an indicator, e.g. a dirty bit.
  • an indicator e.g. a dirty bit.
  • the server Upon receipt of the changed data structure the server search for an indicator indicating a changed access privilege and reconfigures the particular function of the particular networked device associated to this indicator for all selected users of the list of selected access identities, step 620. The search and configuration is repeated until all entries being indicated as changed has been found. Then the new configuration of the access privileges of the system is running.
  • the step 602 of Fig 10 in which a user operates the client to send a request for a list of access identities may result in one of two different retrieval of access identities or authenticated users.
  • the user operating the client may decide to add further access identities to the system and in such a case the access server retrieves the list of users or user groups from a server managing the access and authentication of the network. The selected users will then become registered in the register of the system as well.
  • the user operating the client may decide to change the access privileges of access identities already having accessing privileges in the system. Then the access server retrieves the list of access identities in the access server.
  • the signaling between the client and the server is described in Fig 11 .
  • the example given in Fig 11 relates to a situation where the user of the client intends to add new users to the system. Then the user indicates that he intends to add user or user groups and the client sends a request to the access server for a list of all network users, 702, from which a selection may be performed at the client.
  • the access server contacts the network access and authentication server and retrieves user information and send the data to the client, 704.
  • a selection of users is performed and a request for amending/setting the access privileges of the selected users is sent, 706.
  • the access server returns an information structure including accumulated access privileges of the selected users in view of each function of each networked device, 708.
  • the data structure is amended at the client and the amended information structure is returned to the access server, 710.
  • the amended information structure may include a indicator indicating the access privileges that has been amended.
  • Fig 12 a signaling scheme similar to the scheme of Fig 11 is shown.
  • the example relates to a situation where the user intends to amend the access privileges of already registered access identities.
  • the client sends a message requesting registered access identities, 722, and receives data identifying the registered access identities, 724.
  • the user at the client then make a selection from this data and perform the same signaling as in Fig 11 , i.e. signals 726-730 corresponds to signals 706-710 of Fig 11 .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • Multimedia (AREA)
  • Small-Scale Networks (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Claims (23)

  1. Procédé de configuration de privilèges d'accès dans un système de dispositifs en réseau (12, 14, 16), ledit procédé comprenant :
    la sélection d'une pluralité d'identités d'accès,
    l'extraction d'informations de privilèges d'accès de chacune des identités d'accès sélectionnées à des fonctions accessibles de dispositifs en réseau (12, 14, 16),
    caractérisé par
    le cumul des privilèges d'accès des identités d'accès sélectionnées pour chacune desdites fonctions accessibles de chacun desdits dispositifs en réseau (12, 14, 16), dans lequel ledit cumul des privilèges d'accès comprend le comptage du nombre d'identités d'accès sélectionnées ayant des privilèges d'accès à chacune desdites fonctions de chacun desdits dispositifs en réseau (12, 14, 16),
    la présentation desdits privilèges d'accès cumulés pour chacune desdites fonctions accessibles de chacun desdits dispositifs en réseau (12, 14, 16) dans une interface permettant la modification des privilèges d'accès cumulés,
    l'indication d'un changement des privilèges d'accès cumulés à une fonction spécifique dans un dispositif en réseau spécifique (12, 14, 16), et
    la configuration de la fonction spécifique du dispositif en réseau spécifique (12, 14, 16) pour permettre l'accès par les identités d'accès sélectionnées en fonction du changement indiqué des privilèges d'accès cumulés.
  2. Procédé selon la revendication 1, dans lequel ledit cumul des privilèges d'accès comprend en outre :
    le réglage du privilège d'accès cumulé pour une fonction spécifique d'un dispositif en réseau (12, 14, 16) à une valeur indiquant que toutes les identités d'accès sélectionnées sont autorisées à accéder à la fonction spécifique si ledit comptage indique que toutes les identités d'accès sélectionnées sont autorisées à accéder à la fonction spécifique,
    le réglage du privilège d'accès cumulé pour une fonction spécifique d'un dispositif en réseau à une valeur indiquant qu'aucune des identités d'accès sélectionnées n'est autorisée à accéder à la fonction spécifique si ledit comptage indique qu'aucune des identités d'accès sélectionnées n'est autorisée à accéder à la fonction spécifique, et
    le réglage du privilège d'accès cumulé pour une fonction spécifique d'un dispositif en réseau à une valeur indiquant que certaines des identités d'accès sélectionnées sont autorisées à accéder à la fonction si ledit comptage indique que certaines des identités d'accès sélectionnées sont autorisées à accéder à la fonction.
  3. Procédé selon l'une quelconque des revendications 1 et 2, comprenant en outre l'envoi par le biais d'un réseau d'ordinateurs (20) d'informations représentant lesdites fonctions accessibles desdits dispositifs en réseau (12, 14, 16), d'informations représentant le privilège d'accès cumulé associé à chacune de ces fonctions, et d'informations permettant l'identification des identités d'accès sélectionnées, à un ordinateur client (18) effectuant ladite présentation.
  4. Procédé selon la revendication 3, dans lequel les informations permettant l'identification des identités d'accès sélectionnées constituent une liste (90) comprenant des identifiants des identités d'accès sélectionnées.
  5. Procédé selon la revendication 3, dans lequel les informations permettant l'identification des identités d'accès sélectionnées constituent un identifiant qui identifie l'emplacement d'une liste comprenant des identifiants des identités d'accès sélectionnées.
  6. Procédé selon l'une quelconque des revendications 3 à 5, comprenant en outre le retour par le biais du réseau d'ordinateurs (20) des informations représentant chacune desdites fonctions accessibles de chacun desdits dispositifs en réseau (12, 14, 16), du privilège d'accès cumulé associé à chacune de ces fonctions, et des informations permettant l'identification des identités d'accès sélectionnées, dans lequel le privilège d'accès cumulé associé à au moins une fonction d'un dispositif en réseau a été changé en relation avec les informations correspondantes précédemment envoyées par le biais du réseau d'ordinateurs (20).
  7. Procédé selon la revendication 6, dans lequel l'au moins une fonction d'un dispositif en réseau (12, 14, 16) pour laquelle le privilège d'accès cumulé a été changé est balisée pour indiquer que le privilège d'accès cumulé à cette fonction particulière a été changé en relation avec les informations correspondantes précédemment envoyées par le biais du réseau d'ordinateurs (20).
  8. Procédé selon l'une quelconque des revendications 1 à 7, dans lequel ladite indication d'un changement des privilèges d'accès cumulés à une fonction spécifique dans un dispositif en réseau spécifique (12, 14, 16) ne permet que le changement d'un privilège d'accès d'une fonction spécifique d'un dispositif en réseau spécifique (12, 14, 16) afin de permettre à tous les utilisateurs identifiés par les identités d'accès sélectionnées d'accéder à la fonction spécifique ou afin de ne permettre à aucun des utilisateurs sélectionnés d'accéder à la fonction spécifique.
  9. Procédé selon l'une quelconque des revendications 1 à 8, dans lequel la sélection d'une pluralité d'identités d'accès comprend la sélection d'une pluralité d'identités d'accès parmi les identités d'accès enregistrées pour l'utilisation du système.
  10. Procédé selon l'une quelconque des revendications 1 à 9, dans lequel la sélection d'identités d'accès comprend la sélection d'utilisateurs individuels.
  11. Procédé selon l'une quelconque des revendications 1 à 10, dans lequel la sélection d'identités d'accès comprend la sélection de groupes d'utilisateurs.
  12. Serveur de gestion de privilèges d'accès dans un système de dispositifs en réseau (12, 14, 16), le serveur comprenant :
    un moyen (62) pour gérer la sélection d'identités d'accès apte à recevoir une indication des identités d'accès sélectionnées d'un client (18),
    caractérisé par
    un gestionnaire de privilèges d'accès (68) apte à effectuer l'extraction d'informations de privilèges d'accès d'identités d'accès individuellement sélectionnées à des fonctions accessibles associées à des dispositifs en réseau (12, 14, 16), et apte à générer un message comprenant des privilèges d'accès cumulés d'après les identités d'accès sélectionnées pour lesdites fonctions des dispositifs en réseau (12, 14, 16),
    un cumulateur de privilèges d'accès (70) apte à effectuer le cumul des privilèges d'accès des identités d'accès sélectionnées pour lesdites fonctions accessibles des dispositifs en réseau (12, 14, 16) à partir desdites informations extraites en effectuant le comptage du nombre d'identités d'accès sélectionnées ayant des privilèges d'accès à chacune desdites fonctions accessibles des dispositifs en réseau (12, 14, 16), et
    un configurateur de privilèges d'accès (66) apte à effectuer la configuration des privilèges d'accès des fonctions accessibles des dispositifs en réseau (12, 14, 16) pour les identités d'accès sélectionnées en fonction d'un message reçu comprenant un indicateur (98) indiquant que les privilèges d'accès de ladite fonction dudit dispositif en réseau (12, 14, 16) doivent être changés.
  13. Serveur selon la revendication 12, dans lequel ledit cumulateur de privilèges d'accès est en outre apte à effectuer :
    le réglage du privilège d'accès cumulé pour une fonction spécifique d'un dispositif en réseau (12, 14, 16) à une valeur indiquant que toutes les identités d'accès sélectionnées sont autorisées à accéder à la fonction spécifique si ledit comptage indique que tous les utilisateurs sélectionnés sont autorisés à accéder à la fonction spécifique,
    le réglage du privilège d'accès cumulé pour une fonction spécifique d'un dispositif en réseau (12, 14, 16) à une valeur indiquant qu'aucune des identités d'accès sélectionnées n'est autorisée à accéder à la fonction spécifique si ledit comptage indique qu'aucune des identités d'accès sélectionnées n'est autorisée à accéder à la fonction spécifique, et
    le réglage du privilège d'accès cumulé pour une fonction spécifique d'un dispositif en réseau (12, 14, 16) à une valeur indiquant que certaines des identités d'accès sélectionnées sont autorisées à accéder à la fonction si ledit comptage indique que certaines des identités d'accès sélectionnées sont autorisées à accéder à la fonction.
  14. Serveur selon l'une quelconque des revendications 12 et 13, dans lequel le gestionnaire de privilèges d'accès (68) est apte à inclure, dans ledit message généré, des informations représentant les fonctions accessibles des dispositifs en réseau (12, 14, 16), le privilège d'accès cumulé associé à chaque fonction incluse, et des informations permettant l'identification des identités d'accès sélectionnées.
  15. Serveur selon l'une quelconque des revendications 12 à 14, dans lequel le système est un système de surveillance.
  16. Serveur selon l'une quelconque des revendications 12 à 15, dans lequel les identités d'accès comprennent une identité d'utilisateur.
  17. Serveur selon l'une quelconque des revendications 12 à 16, dans lequel les identités d'accès comprennent une identité de groupe d'utilisateurs.
  18. Client destiné à changer des privilèges d'accès à des fonctions de dispositifs en réseau (12, 14, 16) d'un système, ledit client comprenant :
    un affichage (110),
    un moyen d'entrée (108),
    caractérisé par
    un moyen pour effectuer la sélection d'identités d'accès (112), ledit moyen (112) étant apte à accéder à un serveur d'accès (10) et à demander au serveur d'accès (10) de fournir des informations des identités d'accès du système ou des utilisateurs du réseau, et ledit moyen (112) étant apte à présenter des identités d'accès sur l'affichage (110) et à permettre à l'utilisateur du client de sélectionner des identités d'accès par le biais du moyen d'entrée (108), et
    un moyen pour changer des privilèges d'accès (114) pour des identités d'accès sélectionnées à des fonctions accessibles de dispositifs en réseau (12, 14, 16), ledit moyen (114) étant apte à présenter des privilèges d'accès cumulés en relation avec lesdites fonctions accessibles des dispositifs en réseau (12, 14, 16) sur l'affichage (110), à permettre à un utilisateur du client de sélectionner et de changer les privilèges d'accès cumulés pour des fonctions présentées, et à générer un message comprenant des informations de privilèges d'accès cumulés changés,
    dans lequel lesdits privilèges d'accès cumulés comprennent des entrées relatives au nombre d'identités d'accès sélectionnées qui sont enregistrées comme ayant accès à chacune des fonctions de chacun des dispositifs en réseau (12, 14, 16).
  19. Client selon la revendication 18, dans lequel le moyen (114) pour changer des privilèges d'accès est apte à effectuer la réception d'un message par le biais d'une interface de réseau (102), ledit message comprenant des informations représentant des fonctions accessibles des dispositifs en réseau (12, 14, 16), des informations représentant les privilèges d'accès cumulés associés à chacune de ces fonctions, et des informations permettant l'identification des identités d'accès sélectionnées.
  20. Client selon l'une quelconque des revendication 18 et 19, dans lequel ledit message généré comprend des informations représentant des fonctions accessibles de dispositifs en réseau (12, 14, 16), des informations représentant les privilèges d'accès cumulés associés à chacune de ces fonctions, un indicateur (98) indiquant chaque privilège d'accès cumulé qui a été changé, et des informations permettant l'identification des identités d'accès sélectionnées.
  21. Client selon l'une quelconque des revendications 19 et 20, dans lequel les informations permettant l'identification des identités d'accès sélectionnées constituent une liste (90) comprenant des identifiants des identités d'accès sélectionnées.
  22. Client selon l'une quelconque des revendications 19 et 20, dans lequel les informations permettant l'identification des identités d'accès sélectionnées constituent un identifiant qui identifie l'emplacement d'une liste (90) comprenant des identifiants des utilisateurs sélectionnés.
  23. Client selon l'une quelconque des revendications 18 à 22, dans lequel chaque entrée relative au nombre d'identités d'accès sélectionnées qui sont enregistrées comme ayant accès à chacune des fonctions de chacun des dispositifs en réseau (12, 14, 16) fait référence au fait que :
    toutes les identités d'accès sélectionnées sont enregistrées comme ayant accès à une fonction spécifique d'un dispositif en réseau (12, 14, 16),
    aucune des identités d'accès sélectionnées n'est enregistrée comme ayant accès à une fonction spécifique d'un dispositif en réseau (12, 14, 16), ou
    certaines des identités d'accès sélectionnées sont enregistrées comme ayant accès à une fonction spécifique d'un dispositif en réseau (12, 14, 16).
EP08150277A 2008-01-15 2008-01-15 Procédé et dispositifs de gestion des privilèges d'accès Active EP2081354B1 (fr)

Priority Applications (8)

Application Number Priority Date Filing Date Title
AT08150277T ATE521182T1 (de) 2008-01-15 2008-01-15 Verfahren und vorrichtungen zur handhabung von zugangsvorrechten
ES08150277T ES2370558T3 (es) 2008-01-15 2008-01-15 Método y dispositivos para gestionar privilegios de acceso.
EP08150277A EP2081354B1 (fr) 2008-01-15 2008-01-15 Procédé et dispositifs de gestion des privilèges d'accès
TW097151492A TWI461924B (zh) 2008-01-15 2008-12-30 處理存取特許之方法及裝置
CN200910000290.9A CN101488955B (zh) 2008-01-15 2009-01-09 处理访问权限的方法和设备
US12/353,036 US8713643B2 (en) 2008-01-15 2009-01-13 Method and devices for handling access privileges
KR1020090002865A KR101235408B1 (ko) 2008-01-15 2009-01-14 액세스 특권을 핸들링하는 방법 및 디바이스
JP2009005281A JP4929294B2 (ja) 2008-01-15 2009-01-14 アクセス特権を取り扱うための方法およびデバイス

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP08150277A EP2081354B1 (fr) 2008-01-15 2008-01-15 Procédé et dispositifs de gestion des privilèges d'accès

Publications (2)

Publication Number Publication Date
EP2081354A1 EP2081354A1 (fr) 2009-07-22
EP2081354B1 true EP2081354B1 (fr) 2011-08-17

Family

ID=39591502

Family Applications (1)

Application Number Title Priority Date Filing Date
EP08150277A Active EP2081354B1 (fr) 2008-01-15 2008-01-15 Procédé et dispositifs de gestion des privilèges d'accès

Country Status (8)

Country Link
US (1) US8713643B2 (fr)
EP (1) EP2081354B1 (fr)
JP (1) JP4929294B2 (fr)
KR (1) KR101235408B1 (fr)
CN (1) CN101488955B (fr)
AT (1) ATE521182T1 (fr)
ES (1) ES2370558T3 (fr)
TW (1) TWI461924B (fr)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10419725B2 (en) * 2013-01-10 2019-09-17 Tyco Safety Products Canada Ltd. Security system and method with modular display of information
CN103036912A (zh) * 2013-01-14 2013-04-10 深圳市瑞彩电子技术有限公司 基于HTTP的IP Camera访问方法、服务及系统
US9276958B2 (en) * 2013-02-04 2016-03-01 Ricoh Company, Ltd. Customizing security role in device management system, apparatus and method
CN105446906A (zh) * 2014-09-12 2016-03-30 海能达通信股份有限公司 权限数据动态配置系统、方法及终端设备
FR3031272A1 (fr) * 2014-12-24 2016-07-01 Orange Procede d'obtention de droits mis en oeuvre par un objet communicant
CN105490855B (zh) * 2015-12-11 2019-07-26 北京元心科技有限公司 移动终端及其配置方法
WO2023177399A1 (fr) * 2022-03-17 2023-09-21 Rakuten Symphony Singapore Pte. Ltd Système de demande d'accès privilégié

Family Cites Families (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7079177B2 (en) * 1995-02-27 2006-07-18 Canon Kabushiki Kaisha Remote control system and access control method for information input apparatus with limitation by user for image access and camemremote control
JPH08237532A (ja) * 1995-02-27 1996-09-13 Canon Inc カメラの遠隔制御システム
US6208379B1 (en) 1996-02-20 2001-03-27 Canon Kabushiki Kaisha Camera display control and monitoring system
JPH1042278A (ja) 1996-07-22 1998-02-13 Canon Inc 映像入力システム及び映像入力制御装置及びその方法
JP3634528B2 (ja) 1996-11-29 2005-03-30 キヤノン株式会社 カメラサーバ及びカメラクライアント及び制御方法及びシステム及び記憶媒体
US6449643B1 (en) 1998-05-14 2002-09-10 Nortel Networks Limited Access control with just-in-time resource discovery
AU4885001A (en) * 2000-04-24 2001-11-07 Matsushita Electric Industrial Co., Ltd. Access right setting device and manager terminal
US20030093430A1 (en) 2000-07-26 2003-05-15 Mottur Peter A. Methods and systems to control access to network devices
US20040059704A1 (en) * 2002-09-20 2004-03-25 International Business Machines Corporation Self-managing computing system
US7636853B2 (en) * 2003-01-30 2009-12-22 Microsoft Corporation Authentication surety and decay system and method
US20040167989A1 (en) * 2003-02-25 2004-08-26 Jeff Kline Method and system for creating and managing a website
CN1998013A (zh) * 2003-06-09 2007-07-11 格林莱恩系统公司 用于风险检测、汇报和基础设施的系统和方法
US20050097353A1 (en) * 2003-10-10 2005-05-05 Bea Systems, Inc. Policy analysis tool
TWI268082B (en) * 2004-10-01 2006-12-01 Grand Advance Corp Identification system and method for web camera
US20060130150A1 (en) * 2004-12-09 2006-06-15 Garza-Gonzalez Daniel C Context-sensitive authorization
US7761905B2 (en) * 2004-12-17 2010-07-20 International Business Machines Corporation Method and system for assigning access rights in a computer system
US7617530B2 (en) * 2005-04-22 2009-11-10 Microsoft Corporation Rights elevator
US20060259980A1 (en) * 2005-05-16 2006-11-16 Microsoft Corporation Method and system for limiting rights of services
WO2007069207A2 (fr) * 2005-12-16 2007-06-21 Koninklijke Philips Electronics N.V. Contrôle d’accès dans un réseau
US7706397B2 (en) * 2006-03-31 2010-04-27 Intel Corporation Apparatus and method of controlling transmission in reverse direction
KR100750827B1 (ko) * 2006-04-19 2007-08-23 (주)아이디스 사용자별 권한 설정이 가능한 디지털 비디오 레코더
US20080072292A1 (en) * 2006-09-01 2008-03-20 Narjala Ranjit S Secure device introduction with capabilities assessment
US20080083040A1 (en) * 2006-09-29 2008-04-03 Microsoft Corporation Aggregated resource license

Also Published As

Publication number Publication date
ATE521182T1 (de) 2011-09-15
KR101235408B1 (ko) 2013-02-20
CN101488955B (zh) 2014-01-01
US20090183238A1 (en) 2009-07-16
EP2081354A1 (fr) 2009-07-22
TWI461924B (zh) 2014-11-21
US8713643B2 (en) 2014-04-29
JP4929294B2 (ja) 2012-05-09
TW200943076A (en) 2009-10-16
KR20090078751A (ko) 2009-07-20
JP2009169954A (ja) 2009-07-30
CN101488955A (zh) 2009-07-22
ES2370558T3 (es) 2011-12-20

Similar Documents

Publication Publication Date Title
EP2081354B1 (fr) Procédé et dispositifs de gestion des privilèges d'accès
US20190342231A1 (en) Method for managing computer network access
US20090037520A1 (en) System and method for secure file transfer
US7721300B2 (en) Methods and systems for managing a network
DE60130543T2 (de) Gesichertes netzwerkbetriebsmittelzugriffssystem
US20120072848A1 (en) System and method for social collection
WO2007069338A1 (fr) Procede de regulation d'acces web et programme correspondant
EP4287555A2 (fr) Contrôle d'accès pour des données numériques
US11204676B2 (en) Enterprise workspace notifications service
US7412345B2 (en) System, method, and article of manufacture for obtaining data
CN110210191B (zh) 一种数据处理方法及相关装置
CN106534102A (zh) 设备访问的方法及装置、电子设备
KR20170041614A (ko) 화이트리스트 기반의 네트워크 보안 장치 및 방법
CN107395587A (zh) 一种基于多点协作机制的数据管理方法及系统
US8069180B1 (en) Systems and methods for automated employee resource delivery
EP1379027B1 (fr) Dispositif de réseau local sans fil
CN111988320A (zh) 一种应用识别方法、装置、系统、设备和介质
JP2020095302A (ja) プラント監視制御装置及び、プラント監視制御システム
JP7549717B2 (ja) サーバ、ユーザ端末、システム、及びアクセス制御方法
KR100329222B1 (ko) 비디오신호 저장시스템 및 그 제어방법
US20060010248A1 (en) Document processing management system and method
JP4053043B2 (ja) 設備利用状況表示システム
US20030070093A1 (en) Method for implementing a server-based, common communication identifier for multiple communication applications
CN117542140A (zh) 访客管理方法、装置、系统、电子设备及存储介质
CN118051290A (zh) 访问请求的执行方法和装置、存储介质及电子设备

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA MK RS

17P Request for examination filed

Effective date: 20100118

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602008008875

Country of ref document: DE

Effective date: 20111020

REG Reference to a national code

Ref country code: SE

Ref legal event code: TRGR

REG Reference to a national code

Ref country code: NL

Ref legal event code: VDEP

Effective date: 20110817

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2370558

Country of ref document: ES

Kind code of ref document: T3

Effective date: 20111220

LTIE Lt: invalidation of european patent or patent extension

Effective date: 20110817

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20111219

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20111217

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20111117

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 521182

Country of ref document: AT

Kind code of ref document: T

Effective date: 20110817

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20111118

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

26N No opposition filed

Effective date: 20120521

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20120321

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20120131

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602008008875

Country of ref document: DE

Effective date: 20120521

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20120131

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20120131

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20120115

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20111117

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20110817

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20120115

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20080115

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 9

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 10

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 11

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20190124

Year of fee payment: 12

Ref country code: ES

Payment date: 20190201

Year of fee payment: 12

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200115

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 20210603

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200116

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602008008875

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0065000000

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230505

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20231219

Year of fee payment: 17

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: SE

Payment date: 20231219

Year of fee payment: 17

Ref country code: FR

Payment date: 20231219

Year of fee payment: 17

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20231219

Year of fee payment: 17